Critical Threat
IP 143.208.152.26 is a critical-risk address originating from Brazil that has been linked to 951 hacking-related abuse reports across automated honeypot sensors, representing one of the most malicious IP profiles documented in recent threat intelligence. With a threat level of 10 out of 10 and a 94% confidence score, this address operated by FIBRA EMPRESAS LTDA on AS265130 presents a severe and immediate danger to any exposed network service during its activity window in April 2026.
The volume and consistency of reports paint a clear picture of sustained hostile activity. All 951 reports originate from automated honeypot sensors, with the dominant threat category being general hacking attempts encompassing various intrusion techniques. The address maintained a moderate-to-high activity frequency of 5 out of 10 throughout its reporting period, indicating persistent rather than opportunistic behavior. Its geographic origin in Brazil and association with a business internet service provider suggests this infrastructure may be compromised or operated by malicious actors leveraging legitimate network resources.
General hacking activity represents a broad category of automated and semi-targeted intrusion attempts. These include vulnerability scanning, exploitation attempts against known software weaknesses, brute-force authentication attacks, and probing for misconfigured services. For an organization with an exposed SSH, RDP, web application, or database service, such an IP conducting systematic reconnaissance and attack patterns creates substantial risk of unauthorized access, data exfiltration, or complete system compromise. The sheer volume of reports against this single address indicates it is part of coordinated scanning campaigns rather than isolated probing.
Organizations should implement immediate blocking or rate-limiting measures against this address at the firewall or intrusion prevention system level. Deploying automated tools such as fail2ban can dynamically ban IPs exhibiting brute-force behavior patterns. All exposed services should enforce strong authentication, apply security patches promptly, and employ network monitoring to detect similar scanning patterns from adjacent address ranges. Regular review of honeypot and community abuse feeds helps maintain current blocklists and reduces exposure to credential stuffing and exploitation attempts.
UA 
MX 
GB 
BE 
OM 
RO 
CA